« Volver al listado

CVE-2024-47841

Estado: AnalizadaMedia (6.9)—

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Path Traversal.This issue affects Mediawiki - CSS Extension: from 1.42.X before 1.42.2, from 1.41.X before 1.41.3, from 1.39.X before 1.39.9.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Wikimedia — Wikimedia-extensions-css

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-47841",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-47841",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-07T17:06:16.157977Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 6.9,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
      "affectedData": [
        {
          "vendor": "The Wikimedia Foundation",
          "product": "Mediawiki - CSS Extension",
          "versions": [
            {
              "status": "affected",
              "version": "1.42.x",
              "lessThan": "1.42.2",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.41.x",
              "lessThan": "1.41.3",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.39.x",
              "lessThan": "1.39.9",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:wikimedia:mediawiki-extensions-css:*:*:*:*:*:*:*:*"
          ],
          "vendor": "wikimedia",
          "product": "mediawiki-extensions-css",
          "versions": [
            {
              "status": "affected",
              "version": "1.42.0",
              "lessThan": "1.42.2",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.41.0",
              "lessThan": "1.41.3",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.39.0",
              "lessThan": "1.39.9",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-10-05T02:15:02.470",
  "references": [
    {
      "url": "https://gerrit.wikimedia.org/r/q/I46613d8d50fc978bdac58e2b312ee03324c1edc8",
      "tags": [
        "Patch"
      ],
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"
    },
    {
      "url": "https://phabricator.wikimedia.org/T368628",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"
    },
    {
      "url": "https://phabricator.wikimedia.org/T369486",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Path Traversal.This issue affects Mediawiki - CSS Extension: from 1.42.X before 1.42.2, from 1.41.X before 1.41.3, from 1.39.X before 1.39.9."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de limitación incorrecta de una ruta a un directorio restringido ('Path Traversal') vulnerabilidad en The Wikimedia Foundation Mediawiki - CSS Extension permite Path Traversal. Este problema afecta a Mediawiki - CSS Extension: desde 1.42.X antes de 1.42.2, desde 1.41.X antes de 1.41.3, desde 1.39.X antes de 1.39.9."
    }
  ],
  "lastModified": "2026-06-17T07:57:50.877",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wikimedia:wikimedia-extensions-css:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C84CC2C-175C-43B2-B687-1F3059E25426",
              "versionEndExcluding": "1.39.9",
              "versionStartIncluding": "1.39.0"
            },
            {
              "criteria": "cpe:2.3:a:wikimedia:wikimedia-extensions-css:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3C653764-2F82-4DFA-8679-44040C0EB5CB",
              "versionEndExcluding": "1.41.3",
              "versionStartIncluding": "1.41.0"
            },
            {
              "criteria": "cpe:2.3:a:wikimedia:wikimedia-extensions-css:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "38BB6671-A00E-418E-BAD8-BA54401F0E6A",
              "versionEndExcluding": "1.42.2",
              "versionStartIncluding": "1.42.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"
}